1. Controller
The controller under the General Data Protection Regulation (GDPR) is LetzPrint S.à r.l.-S, 19, rue des Alliés, L-4412 Belvaux, Luxembourg. Privacy contact: [email protected].
2. Data we process
Depending on how LetzVet is used, we may process account and contact details, authentication and security data, provider and business information, pet profile information, appointment and booking data, communications and support requests, reviews and complaints, and technical, device and security logs. For providers, registry, professional qualification and verification documents may also be processed.
LetzVet is not intended to store full veterinary medical records without a specific need. Users should not enter unnecessary personal data about third parties in free-text fields.
3. Purposes and legal bases
We process data to provide the platform and user account, facilitate or technically manage appointments and bookings, communicate with users and providers and perform LetzPrint’s own contracts under Article 6(1)(b) GDPR. Processing required by law is based on Article 6(1)(c). IT security, abuse prevention, error analysis, legal defence and safe operation may rely on legitimate interests under Article 6(1)(f). Analytics, marketing or tracking activities that require consent are only activated after valid consent under Article 6(1)(a).
4. Roles of LetzPrint and providers
LetzPrint is responsible for its own platform processes. The booked veterinarian, clinic or other provider is generally independently responsible for the professional service, its own client administration and its professional records. Joint controllership is only assumed where it actually exists for a specific data flow and is documented accordingly.
5. Recipients and service providers
Host Europe GmbH is used as hosting provider. The exact technical data-centre location depends on the contracted plan and is documented by LetzPrint using the contractual/customer information. Other service providers — such as email, payment, security, support or analytics providers — may only be used in accordance with the services actually enabled in the system.
Where online payments are enabled, payment data should, where possible, be processed directly by a regulated payment service provider. LetzPrint should not itself hold funds owed to an independent provider without a documented regulatory basis.
6. Cookies and similar technologies
Strictly necessary technologies may be used without consent where legal conditions are met. Analytics, marketing, external media and other non-essential technologies are not activated before any required consent has been obtained. Withdrawing consent must be as easy as giving it. The technologies actually used must be listed in the site’s cookie settings and cookie information.
7. Retention
Data is kept only for as long as required for the relevant purpose or for applicable legal retention, evidence or limitation periods. Contract, accounting and tax records may be subject to multi-year statutory retention. Account, support and technical data that is no longer needed is deleted or anonymised under the documented deletion policy.
8. Transfers outside the EEA
Where a service provider processes data outside the European Economic Area, the transfer takes place only on a valid legal basis, such as an adequacy decision or appropriate safeguards including Standard Contractual Clauses where required.
9. Your rights
Subject to the GDPR, data subjects have rights including access, rectification, erasure, restriction, portability and objection. Consent may be withdrawn at any time for the future. A complaint may also be filed with the Luxembourg CNPD or, where competent, with a supervisory authority in the data subject’s country of residence.
10. Automated decisions
LetzVet currently does not make decisions based solely on automated processing within the meaning of Article 22 GDPR that produce legal or similarly significant effects for users. This policy must be updated before any such functionality is activated.
11. Contact
Privacy and data-subject requests: [email protected].
- Host Europe GmbH, Gertrudenstraße 30-36, 50667 Cologne, Germany — Operating the platform; the server processes every request. The data centre follows the tariff LetzPrint has booked and is documented internally; no server location may be inferred from the provider’s registered office. Art. 6(1)(f) GDPR — legitimate interest in operating the service. Acts on our instructions under a contract as required by Art. 28 GDPR.
- OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom — Three things go there. Map tiles: when a map loads, your IP address is transmitted to OpenStreetMap’s servers, which is technically necessary to deliver the tiles, and no tracking cookies are set. Place search: what you type into the location field — up to 200 characters, which is enough for a street address — is sent from our server to the Nominatim search service of the same foundation in order to turn it into coordinates. Place name: when you use “Near me”, your position, rounded to about 100 metres, is sent from our server to the same service to find the name of the place, which is then shown to you; nothing that identifies you is sent with it. Art. 6(1)(f) GDPR — legitimate interest in showing findable locations, in resolving a typed place into a search radius, and in telling you which place your shared position was matched to. Decides its own purposes for the data it receives; there is no processing contract with us, and it is responsible for that processing itself. United Kingdom, covered by the adequacy decision — Implementing Decision (EU) 2021/1772 as amended by Implementing Decision (EU) 2025/2574 of 19 December 2025, which runs until 27 December 2031. The foundation delivers map tiles through a worldwide network of cache servers, so the server that answers a tile request can sit outside the United Kingdom and outside the EEA. Last verified at the primary source on 2026-09-09. Privacy notice
- Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA — Checks that a form was submitted by a person; receives the IP address and a challenge token. Art. 6(1)(f) GDPR — legitimate interest in protecting the forms from abuse. Acts on our instructions under a contract as required by Art. 28 GDPR. United States. The data importer under the customer data processing addendum is Cloudflare, Inc.; the transfer rests on its certification under the EU-U.S. Data Privacy Framework, with the EU standard contractual clauses (Art. 46(2)(c) GDPR) as the fallback. Last verified at the primary source on 2026-09-09. Privacy notice
- mail.anilevia.eu — Sending booking confirmations, reminders and account e-mails: the recipient address and the message content. Art. 6(1)(b) GDPR — performance of the contract. Acts on our instructions under a contract as required by Art. 28 GDPR.
- Google LLC, Mountain View, CA, USA (Chrome and Chromium browsers) · Apple Inc., Cupertino, CA, USA (Safari, iOS) · Mozilla Corporation, San Francisco, CA, USA (Firefox) · Microsoft Corporation, Redmond, WA, USA (Edge on Windows) — Delivering notifications you switched on: your browser registers with its manufacturer’s push service, and every notification travels through it. Title and text are encrypted for that service and it cannot read them; what it does receive is an address created for your device, your IP address and the time of each delivery. Art. 6(1)(a) GDPR — your consent, given per device and withdrawable at any time. Decides its own purposes for the data it receives; there is no processing contract with us, and it is responsible for that processing itself. United States. For Google and Microsoft the transfer rests on the adequacy decision — Implementing Decision (EU) 2023/1795 — for as long as their entry on the Data Privacy Framework list is active. For Apple and Mozilla there is neither an adequacy decision nor standard contractual clauses concluded by us; that transfer rests on your explicit consent under Art. 49(1)(a) GDPR, given after being informed of the risks. Last verified at the primary source on 2026-09-09. Privacy notice of Google Privacy notice of Apple Privacy notice of Mozilla Privacy notice of Microsoft
- Management and calendar systems that an individual business runs or commissions itself; located wherever that business is, which may be outside the EEA (webhooks) — Businesses on the highest tier may forward their own booking data to a system of their choice. Where they do, that business decides the recipient and is responsible for it. What is forwarded: the customer’s name, e-mail address and telephone number, the pet’s name and species, and any note the customer wrote. Art. 6(1)(b) GDPR — performance of the booking; the receiving business is the controller for its own system. Decides its own purposes for the data it receives; there is no processing contract with us, and it is responsible for that processing itself.
Where directory data comes from
Our directory also contains businesses that have not registered with us. Their entries hold only what a business publishes about itself in the ordinary course of trade: name, address, telephone number, website, opening hours and field of work.
We obtain this information from: the official veterinary register, public business directories, the business’s own website, public business profiles, our own research, the business itself, by telephone or e-mail.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and the interest of pet owners, is a complete and findable overview of care nearby: a directory that only held businesses which had signed up would send somebody looking for a vet at nine in the evening to a shorter list than the one that exists. We do not take entries from competing platforms.
How long we keep it: for as long as the business exists and the entry is part of the directory. If somebody objects, or asks for removal, the entry goes; what remains is only the record that it was removed and when, so that it is not re-imported.
Who receives it: the entry is publicly retrievable on this site, so it is disclosed to anyone who visits. Beyond that, only the service providers listed as recipients in this statement receive anything, and only what they need to run the site.
Transfer outside the EU/EEA: none takes place for directory entries. The recipient list in this statement names every recipient and the basis on which they receive anything.
Automated decisions: there are none in the sense of Art. 22 GDPR. No entry is created, ranked or removed by an automated decision with legal or similarly significant effect.
Your rights: access, rectification, erasure, restriction, data portability – and objection under Art. 21 GDPR at any time, on grounds relating to your particular situation. If you object, we stop processing the entry unless we can show compelling legitimate grounds that override your interests.
Every profile carries a "Report wrong details" form, and a business can claim its entry and manage it itself.
You may lodge a complaint with a supervisory authority – in particular the CNPD in Luxembourg, or the authority of the country you live or work in (Art. 77 GDPR).
If we have written to you about your entry
We write to listed businesses by post to tell them that an entry about them has been prepared, to show them what it says, and to invite them to take it over. That is a purpose of its own, separate from keeping the directory itself.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is winning the supply side of a two-sided market: a directory of care is worth nothing to pet owners unless the businesses in it can maintain their own entries. The interest of the business is the same in the other direction – an entry already exists, and this letter is how it learns that it can correct, take over or have it removed.
Categories of data used for this: business name, postal address, language, kind of business and the class of source the entry came from – plus the records the outreach itself produces: whether a letter was generated, printed or sent, whether the invitation link was opened, and dated notes of any contact.
Where the address comes from is set out above, in the section on where directory data comes from. We do not take entries or addresses from competing platforms.
How long: outreach records – recipient rows and contact notes – are deleted after 3 years. An entry on the do-not-contact list is the exception: it is kept for as long as the directory exists, because deleting it would make the business contactable again, which is the opposite of what was asked for.
Your right to object to being contacted
You may object at any time to your data being used to contact you in this way, under Art. 21(2) GDPR. You do not have to give a reason, and we stop straight away – there is no weighing of interests against an objection to direct marketing.
You can do this: by e-mail to [email protected]; through the "Report wrong details" form on your entry, by choosing "Please do not write to us again"; by post, to the address given in the legal notice.
What happens then: we record the objection on a do-not-contact list. We keep that list precisely so that we cannot write to you again by mistake – a deleted objection would leave nothing standing in the way of the next campaign. The list holds only what is needed for that: which entry or address is blocked, why, and when. If you later want to hear from us after all, tell us and we take you off it.
You may also lodge a complaint with a supervisory authority – in Luxembourg the Commission nationale pour la protection des données (CNPD), or the authority of the country you live or work in (Art. 77 GDPR).
Who receives your payment
Online payment to us is not switched on. Nothing you owe a business is paid through this site: you settle with the business directly, on their terms.
The patient record your practice keeps here
If you are a customer of a business that uses this platform, that business can keep a file about your animal here. It holds:
- weight entries
- vaccinations, with the date and what was given
- dated treatment notes written by the business
- reminders for a coming vaccination or check-up
- repeat prescription and food re-order requests — which you write yourself, and which the business answers with a status
- documents attached to an appointment
For this file the business is the controller, and we are its processor under Art. 28 GDPR: we hold and display it on the business’s instructions and do not use it for our own purposes.
What that means for you in practice: a request for access to, correction of or deletion of a clinical note goes to the business, not to us. Ask us and we will pass it on and help — but the decision is the business’s, and in some countries it is also under a professional duty to keep records for a set number of years.
How long: an entry written by a business stays for 10 years unless that business tells us otherwise, because its own retention duty comes first.
What you write yourself — the weights you record, the re-order requests — is ours to handle and goes when you remove the animal or close your account. What the business wrote stays with the business; the animal simply leaves your account.